{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,2]],"date-time":"2025-11-02T00:04:11Z","timestamp":1762041851242,"version":"build-2065373602"},"publisher-location":"Cham","reference-count":44,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783030871987"},{"type":"electronic","value":"9783030871994"}],"license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2021]]},"DOI":"10.1007\/978-3-030-87199-4_4","type":"book-chapter","created":{"date-parts":[[2021,9,23]],"date-time":"2021-09-23T06:19:41Z","timestamp":1632377981000},"page":"36-47","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":14,"title":["A Hierarchical Feature Constraint to\u00a0Camouflage Medical Adversarial Attacks"],"prefix":"10.1007","author":[{"given":"Qingsong","family":"Yao","sequence":"first","affiliation":[]},{"given":"Zecheng","family":"He","sequence":"additional","affiliation":[]},{"given":"Yi","family":"Lin","sequence":"additional","affiliation":[]},{"given":"Kai","family":"Ma","sequence":"additional","affiliation":[]},{"given":"Yefeng","family":"Zheng","sequence":"additional","affiliation":[]},{"given":"S. Kevin","family":"Zhou","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2021,9,21]]},"reference":[{"key":"4_CR1","unstructured":"Athalye, A., Carlini, N., Wagner, D.: Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In: ICLR (2018)"},{"key":"4_CR2","doi-asserted-by":"crossref","unstructured":"Carlini, N., Wagner, D.: Adversarial examples are not easily detected: bypassing ten detection methods. In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp. 3\u201314 (2017)","DOI":"10.1145\/3128572.3140444"},{"key":"4_CR3","doi-asserted-by":"crossref","unstructured":"Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: IEEE Symposium on Security and Privacy, pp. 39\u201357 (2017)","DOI":"10.1109\/SP.2017.49"},{"issue":"1","key":"4_CR4","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1111\/j.2517-6161.1977.tb01600.x","volume":"39","author":"AP Dempster","year":"1977","unstructured":"Dempster, A.P., Laird, N.M., Rubin, D.B.: Maximum likelihood from incomplete data via the EM algorithm. J. R. Stat. Soc.: Ser. B (Methodol.) 39(1), 1\u201322 (1977)","journal-title":"J. R. Stat. Soc.: Ser. B (Methodol.)"},{"key":"4_CR5","unstructured":"Dong, Y., et al.: Benchmarking adversarial robustness. In: CVPR (2020)"},{"key":"4_CR6","doi-asserted-by":"crossref","unstructured":"Dong, Y., et al.: Boosting adversarial attacks with momentum. In: CVPR, pp. 9185\u20139193 (2018)","DOI":"10.1109\/CVPR.2018.00957"},{"key":"4_CR7","unstructured":"Dziugaite, G.K., Ghahramani, Z., Roy, D.M.: A study of the effect of JPG compression on adversarial images. arXiv preprint arXiv:1608.00853 (2016)"},{"key":"4_CR8","unstructured":"Feinman, R., Curtin, R.R., Shintre, S., Gardner, A.B.: Detecting adversarial samples from artifacts. arXiv preprint arXiv:1703.00410 (2017)"},{"issue":"6433","key":"4_CR9","doi-asserted-by":"publisher","first-page":"1287","DOI":"10.1126\/science.aaw4399","volume":"363","author":"SG Finlayson","year":"2018","unstructured":"Finlayson, S.G., Chung, H.W., Kohane, I.S., Beam, A.L.: Adversarial attacks against medical deep learning systems. Science 363(6433), 1287\u20131289 (2018)","journal-title":"Science"},{"key":"4_CR10","unstructured":"Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: ICLR (2015)"},{"key":"4_CR11","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: CVPR, pp. 770\u2013778 (2016)","DOI":"10.1109\/CVPR.2016.90"},{"key":"4_CR12","doi-asserted-by":"crossref","unstructured":"He, X., Yang, S., Li, G., Li, H., Chang, H., Yu, Y.: Non-local context encoder: Robust biomedical image segmentation against adversarial attacks. In: AAAI, vol. 33, pp. 8417\u20138424 (2019)","DOI":"10.1609\/aaai.v33i01.33018417"},{"key":"4_CR13","unstructured":"Kaggle: APTOS 2019 Blindness Detection (2019). https:\/\/www.kaggle.com\/c\/aptos2019-blindness-detection"},{"key":"4_CR14","unstructured":"Kaggle: Chest X-Ray Images (Pneumonia) (2019). https:\/\/www.kaggle.com\/paultimothymooney\/chest-xray-pneumonia"},{"key":"4_CR15","unstructured":"Krizhevsky, A.: Learning multiple layers of features from tiny images. University of Toronto, May 2012"},{"key":"4_CR16","unstructured":"Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial machine learning at scale. In: ICLR (2017)"},{"key":"4_CR17","unstructured":"Ji, W., et al.: Uncertainty quantification for medical image segmentation using dynamic label factor allocation among multiple raters. In: MICCAI on QUBIQ Workshop (2020)"},{"key":"4_CR18","doi-asserted-by":"crossref","unstructured":"Ji, W., et al.: Learning calibrated medical image segmentation via multi-rater agreement modeling. In: CVPR, pp. 12341\u201312351, June 2021","DOI":"10.1109\/CVPR46437.2021.01216"},{"key":"4_CR19","unstructured":"Lee, K., Lee, K., Lee, H., Shin, J.: A simple unified framework for detecting out-of-distribution samples and adversarial attacks. In: ICLR, pp. 7167\u20137177 (2018)"},{"key":"4_CR20","doi-asserted-by":"publisher","first-page":"3053","DOI":"10.1109\/TMI.2020.2986242","volume":"39","author":"H Li","year":"2020","unstructured":"Li, H., et al.: High-resolution chest x-ray bone suppression using unpaired CT structural priors. IEEE Trans. Med. Imaging 39, 3053\u20133063 (2020)","journal-title":"IEEE Trans. Med. Imaging"},{"key":"4_CR21","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"417","DOI":"10.1007\/978-3-030-59719-1_41","volume-title":"Medical Image Computing and Computer Assisted Intervention \u2013 MICCAI 2020","author":"H Li","year":"2020","unstructured":"Li, H., Han, H., Zhou, S.K.: Bounding maps for universal lesion detection. In: Martel, A.L., et al. (eds.) MICCAI 2020. LNCS, vol. 12264, pp. 417\u2013428. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-59719-1_41"},{"key":"4_CR22","doi-asserted-by":"crossref","unstructured":"Li, X., Zhu, D.: Robust detection of adversarial attacks on medical images. In: IEEE International Symposium on Biomedical Imaging, pp. 1154\u20131158. IEEE (2020)","DOI":"10.1109\/ISBI45749.2020.9098628"},{"key":"4_CR23","doi-asserted-by":"crossref","unstructured":"Lu, J., Issaranon, T., Forsyth, D.: SafetyNet: detecting and rejecting adversarial examples robustly. In: ICCV, October 2017","DOI":"10.1109\/ICCV.2017.56"},{"key":"4_CR24","unstructured":"Ma, X., et al.: Characterizing adversarial subspaces using local intrinsic dimensionality. In: ICLR (2018)"},{"key":"4_CR25","doi-asserted-by":"publisher","first-page":"107332","DOI":"10.1016\/j.patcog.2020.107332","volume":"110","author":"X Ma","year":"2020","unstructured":"Ma, X., et al.: Understanding adversarial attacks on deep learning based medical image analysis systems. Pattern Recogn. 110, 107332 (2020)","journal-title":"Pattern Recogn."},{"issue":"Nov","key":"4_CR26","first-page":"2579","volume":"9","author":"LVD Maaten","year":"2008","unstructured":"Maaten, L.V.D., Hinton, G.: Visualizing data using t-SNE. J. Mach. Learn. Res. 9(Nov), 2579\u20132605 (2008)","journal-title":"J. Mach. Learn. Res."},{"key":"4_CR27","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: ICLR (2018)"},{"key":"4_CR28","unstructured":"Metzen, J.H., Genewein, T., Fischer, V., Bischoff, B.: On detecting adversarial perturbations. In: ICLR (2017)"},{"key":"4_CR29","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"300","DOI":"10.1007\/978-3-030-32245-8_34","volume-title":"Medical Image Computing and Computer Assisted Intervention \u2013 MICCAI 2019","author":"U Ozbulak","year":"2019","unstructured":"Ozbulak, U., Van Messem, A., De Neve, W.: Impact of adversarial examples on deep learning models for biomedical image segmentation. In: Shen, D., et al. (eds.) MICCAI 2019. LNCS, vol. 11765, pp. 300\u2013308. Springer, Cham (2019). https:\/\/doi.org\/10.1007\/978-3-030-32245-8_34"},{"key":"4_CR30","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z.B., Swami, A.: Practical black-box attacks against machine learning. In: ASIA Computer and Communications Security, pp. 506\u2013519 (2017)","DOI":"10.1145\/3052973.3053009"},{"key":"4_CR31","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Wu, X., Jha, S., Swami, A.: Distillation as a defense to adversarial perturbations against deep neural networks. In: IEEE Symposium on Security and Privacy, pp. 582\u2013597. IEEE (2016)","DOI":"10.1109\/SP.2016.41"},{"key":"4_CR32","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"493","DOI":"10.1007\/978-3-030-00928-1_56","volume-title":"Medical Image Computing and Computer Assisted Intervention \u2013 MICCAI 2018","author":"M Paschali","year":"2018","unstructured":"Paschali, M., Conjeti, S., Navarro, F., Navab, N.: Generalizability vs. robustness: investigating medical imaging networks using adversarial examples. In: Frangi, A.F., Schnabel, J.A., Davatzikos, C., Alberola-L\u00f3pez, C., Fichtinger, G. (eds.) MICCAI 2018. LNCS, vol. 11070, pp. 493\u2013501. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-030-00928-1_56"},{"key":"4_CR33","unstructured":"Sabour, S., Cao, Y., Faghri, F., Fleet, D.J.: Adversarial manipulation of deep representations. In: IEEE Symposium on Security and Privacy (2016)"},{"key":"4_CR34","unstructured":"Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. In: ICLR (2015)"},{"key":"4_CR35","unstructured":"Szegedy, C., et al.: Intriguing properties of neural networks. In: ICLR (2014)"},{"key":"4_CR36","doi-asserted-by":"crossref","unstructured":"Taghanaki, S.A., Abhishek, K., Azizi, S., Hamarneh, G.: A kernelized manifold mapping to diminish the effect of adversarial perturbations. In: CVPR, pp. 11340\u201311349 (2019)","DOI":"10.1109\/CVPR.2019.01160"},{"key":"4_CR37","unstructured":"Tramer, F., Carlini, N., Brendel, W., Madry, A.: On adaptive attacks to adversarial example defenses. In: ICLR (2020)"},{"key":"4_CR38","unstructured":"Tram\u00e8r, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., McDaniel, P.: Ensemble adversarial training: attacks and defenses. In: ICLR (2018)"},{"key":"4_CR39","doi-asserted-by":"crossref","unstructured":"Xu, W., Evans, D., Qi, Y.: Feature squeezing: detecting adversarial examples in deep neural networks. In: Network and Distributed System Security Symposium (2017)","DOI":"10.14722\/ndss.2018.23198"},{"key":"4_CR40","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"692","DOI":"10.1007\/978-3-030-59719-1_67","volume-title":"Medical Image Computing and Computer Assisted Intervention \u2013 MICCAI 2020","author":"Q Yao","year":"2020","unstructured":"Yao, Q., He, Z., Han, H., Zhou, S.K.: Miss the point: targeted adversarial attack on multiple landmark detection. In: Martel, A.L., et al. (eds.) MICCAI 2020. LNCS, vol. 12264, pp. 692\u2013702. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-59719-1_67"},{"key":"4_CR41","doi-asserted-by":"crossref","unstructured":"Yao, Q., Xiao, L., Liu, P., Zhou, S.K.: Label-free segmentation of COVID-19 lesions in lung CT. IEEE Trans. Med. Imaging (2020)","DOI":"10.1109\/TMI.2021.3066161"},{"key":"4_CR42","unstructured":"Zheng, Z., Hong, P.: Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks. In: Advances in Neural Information Processing Systems, pp. 7913\u20137922 (2018)"},{"issue":"5","key":"4_CR43","doi-asserted-by":"publisher","first-page":"820","DOI":"10.1109\/JPROC.2021.3054390","volume":"109","author":"SK Zhou","year":"2021","unstructured":"Zhou, S.K., et al.: A review of deep learning in medical imaging: imaging traits, technology trends, case studies with progress highlights, and future promises. Proc. IEEE 109(5), 820\u2013838 (2021)","journal-title":"Proc. IEEE"},{"key":"4_CR44","volume-title":"Handbook of Medical Image Computing and Computer Assisted Intervention","author":"SK Zhou","year":"2019","unstructured":"Zhou, S.K., Rueckert, D., Fichtinger, G.: Handbook of Medical Image Computing and Computer Assisted Intervention. Academic Press, Cambridge (2019)"}],"container-title":["Lecture Notes in Computer Science","Medical Image Computing and Computer Assisted Intervention \u2013 MICCAI 2021"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-87199-4_4","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,8]],"date-time":"2024-09-08T18:47:00Z","timestamp":1725821220000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-87199-4_4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"ISBN":["9783030871987","9783030871994"],"references-count":44,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-87199-4_4","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2021]]},"assertion":[{"value":"21 September 2021","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"MICCAI","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Medical Image Computing and Computer-Assisted Intervention","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Strasbourg","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"France","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2021","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27 September 2021","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"1 October 2021","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"24","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"miccai2021","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/miccai2021.org\/en\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Double-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Microsoft CMT","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"1622","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"531","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"33% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"4","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"The conference was held virtually.","order":10,"name":"additional_info_on_review_process","label":"Additional Info on Review Process","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}